Extracted

• • Target

    Order_006543.exe

  • Size

    670KB

  • MD5

    fc8b4a2e2f7b84693d618cb66e07b486

  • SHA1

    494f1f0ffc96fa7c62e093791c9caae487254058

  • SHA256

    f2880cca891b77df9616dcad027fbba4e2e3425a5c0e3a91ee4a6035572053e2

  • SHA512

    e0310dac4512ed920874df283eb38d146933ef8c0e224ab4a6f87f75fa7ad6550a8c0149bc6a4903684e7fdea63e2821cd9f3f3dfe2ea1c9a5b42e8a174af1a3

  • SSDEEP

    12288:MTH/lHMH91DzZ7UWg4v8pKjz88P0D0jOZTcK3MsOaoQ0zXi:qH9HMd1Dt7UnXkjdxqZTcKPh0G

  Score

  10^/10

  snakekeyloggerstormkittycollectionkeyloggerspywarestealer

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger

  • Snake Keylogger payload

  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • StormKitty payload

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses Microsoft Outlook profiles

    collection

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2